Goran

Changed with HxD, Signed, 777 everything... but nothing happens... maybe that BRANCH??? i will try to breakpoint that LOC... to see what happens... how to breakpoint this loc? " loc_4CF252 " "b 0x4CF252"?

that is probably itunes driver, reinstall whole itune, fir uninstall all apple products... second what can it be, is connecting port dock on ihpone...

nothing happening on decrease or increase.......

use LLDB, not GDB....

Done there NOP ' 0x4cf248' C0 46 but game start loading, does not freeze, but after some load crash...

ok, but this function is not good... Game starts, but on loading screen it just stays on COIN DOZER LOADING :) and nothing happens, no crash, no game, just stay ike that... can you try another one??? some other code... :) maybe, that coins just increase instead of decrease... or R7 but in some other way.... :)

will try that now with HxD.... to see does it works... also, how i can compile that in DEB tweak???

am learning so i need help with "for noob" explanation Here is function in Ida PRO... that i need to change to get COIN INCREASE instead of decrease... AND to get unlimited coins but not to go on negative.... if you can get me both scenarios and functions and explanation... THANKS... R1 Holds Coin value.... text:004CF252 loc_4CF252 ; CODE XREF: sub_4CEE7C+3CCj __text:004CF252 ADD.W R0, R4, R11,LSL#2 ; Rd = Op1 + Op2 __text:004CF256 LDR R1, [SP,#0x34+var_2C] ; Load from Memory __text:004CF258 STR R1, [R0,#0x10] ; Store to Memory __text:004CF25A LDR.W R0, [R8,#0x30] ; Load from Memory __text:004CF25E ADDS R0, #1 ; Rd = Op1 + Op2 __text:004CF260 STR.W R0, [R8,#0x30] ; Store to Memory __text:004CF264 ADD SP, SP, #0x1C ; Rd = Op1 + Op2 __text:004CF266 POP.W {R8,R10,R11} ; Pop registers __text:004CF26A POP {R4-R7,PC} ; Pop registers

Finally... I will make new posts if i got problems, and i will got... Thanks....

which one EXACTLY???

ok, i undestand now, but where is adress on this picture that i need to find in IDA PRO... can you mark that address on picture or write it down here...? And thanks for learning me...

YES I AM SIR LOL Where i need to jump, that is reason, why i tell you you need to write me EXACT what you will do in this case... with adress and everything

yeap.... in ida that offset is.... PUSH {R4-R7,LR} ADD R7, SP, #0xC PUSH.W {R8,R10,R11} SUB.W R4, SP, #0x40 BFC.W R4, #0, #4 MOV SP, R4 VST1.64 {D8-D11}, [R4@128]! VST1.64 {D12-D15}, [R4@128] SUB SP, SP, #0x40 MOV R4, R0 MOV R0, #(selRef_class - 0x1C6C2) MOV R2, #(classRef_AVKitVideoPlayback - 0x1C6C4) ADD R0, PC ; selRef_class ADD R2, PC ; classRef_AVKitVideoPlayback LDR R1, [R0] ; "class" LDR R0, [R2] ; _OBJC_CLASS_$_AVKitVideoPlayback BLX.W j__objc_msgSend MOV R5, R0 MOV R0, #(___gxx_personality_sj0_ptr - 0x1C6DA) LDR R1, =(unk_199EFCC - 0x1C6DC) ADD R0, PC ; ___gxx_personality_sj0_ptr ADD R1, PC ; unk_199EFCC LDR R0, [R0] ; ___gxx_personality_sj0 STR R0, [SP,#0x58+var_34] LDR R0, =(sub_1C7BC - 0x1C6EC) STR R1, [SP,#0x58+var_30] ORR.W R0, R0, #1 STR R7, [SP,#0x58+var_2C] ADD R0, PC ; sub_1C7BC STR.W SP, [SP,#0x58+var_24] STR R0, [SP,#0x58+var_28] ADD R0, SP, #0x58+var_4C BLX.W j___Unwind_SjLj_Register CMP R5, R4 BNE loc_1C7A0 in what to change and why? i ask so i can understand...

R1... So what is that offset in this case? which one exact? write me in numbers...

So, what then i need to search in ida??? Is that address or offset? Also, am i looking R2 address? in ida? if you can tell me that exacly so i can understand..

Can you please write me function that i need to enter in LLDB? ohh, something you can learn from me ;)

i know the command that is b 0x???? but am stuck in next step of this... it is CoinDozer game.... Am practicing on that... Am doing Coins, no ASLR.... And i dont know WHICH ADDRESS in this case to watch or breakpoint...??? I need exact command in this case with exact address so i can understand... this Register hold coin value.... r1 = 0x000186b2 CoinDozer.__TEXT.__text + 60642 so i need that you write to me exact command that you will be using in this case on live example, and why, so i can understand... thanks....

you got me nice explanation, thanks, BUT... What is in this case "offset i get in LLDB? http://imgur.com/Wnltf2f can you write me full command with offset for this case (like you are doing hack and writing next step of this), cuz i dont understand where is that new offset i got... Thanks man...

thanks

what is here subx man? and if you can write me "noob like" explanation, with LIVE EXAMPLE on this case... like you are doing this in ida pro...

I got this text in LLDB, finding coins in ZLATAN LEGENDS... Removed Aslr and thined binary... its ARMv7 game... Here is what i got in LLDB.... w s e -- 0x10A21F20 Watchpoint created: Watchpoint 1: addr = 0x10a21f20 size = 4 state = enabled type = w new value: 3719 (lldb) c Process 201251 resuming (lldb) Process 201251 stopped * thread #1: tid = 0x31223, 0x00051ee0 mimosa`ticationMethod_Basic + 303594, stop reason = watchpoint 1 frame #0: 0x00051ee0 mimosa`ticationMethod_Basic + 303594 mimosa`ticationMethod_Basic + 279210: 0x51ee0: ldrbmi r6, [r0, -r3, asr #4]! 0x51ee4: sbcvs r6, r3, #0x20000008 0x51ee8: movwvs r4, #0x2770 Watchpoint 1 hit: old value: 3719 new value: 3842 Now I need "retard like" explanation.... what to do in IDA PRO... i loaded binary, everything is ready... i nned to know what to search from this LLDB info, in ida pro... noob like explanation.... Thanks for helping... and if someone can explain me this functions.... 0x51ee0: ldrbmi r6, [r0, -r3, asr #4]! 0x51ee4: sbcvs r6, r3, #0x20000008 0x51ee8: movwvs r4, #0x2770 coins are in this case...

i found, i must run putty directly from ifunbox, not external one... Thanks maan, you solved my few years mistery.... place this iTunesDriver64_0205.exe is what fixed it for me heres the link http://www.datafilehost.com/d/6b5b5e81 in this tutorial so people can solve problems... Thank you mann

It solved one stuff, but... now lldb work, it says on seccond window CONNECTED but PUTTY says PUTTY FATAL ERROR: Network Error: Connection refused....

maan thank you.. i tried few times over few years.. never found problem... where is that tutorial? can you stick it here??? THANKS A LOT